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AMENDMENT TO THE CLAIMS 
The following claim listing replaces all previous claim listings in this application: 

1 . (Original) A method of managing security in an enterprise, comprising: 

detecting at periodic intervals events that correspond to user interactions with computers 

connected to a network of the enterprise; 
storing such events in a data facility; 

organizing the events by user, by computer and by event type; and 
presenting a summary of the events in a report, wherein a viewer of the report may select 
the organization of the report by user, by computer and by event type. 

2. (Original) A method of claim 1 , wherein the report is in a graphical format. 

3. (Original) A method of claim 1, further comprising limiting access to the report based on 
a predetermined level of authority of the party seeking access. 

4. (Original) A method of claim 1, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a trackball event, a cursor 
event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

5. (Original) A method of claim 1, wherein the user is selected from the group consisting of 
an employee, a consultant, a teacher, a student, a government official, a patient, a volunteer, an 
attendant, a team member, a system administrator, a contractor, a vendor, a clerk, a cashier, a 
teller, a comptroller, an accountant, an attorney, a financial officer, a principal, an administrator, 
a human resources employee, a broker, a gaming employee, a guard, a banker, a government 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 
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6. (Original) A method of claim 1 , wherein the report relates to compliance with a policy of 
the enterprise. 

7. (Original) A method of claim 1, wherein the report relates to security of the enterprise. 

8. (Original) A method of claim 1, wherein the report relates to performance of an objective 
of the enterprise. 

9. (Original) A method of claim 1 , wherein the report relates to content viewed by the user, 
the content selected from the group consisting of chat room content, content relating to 
securities, insider trading information, content relating to gaming, pornographic content, illegal 
content, vulgar content, prurient content, gambling content, entertainment content, video game 
content, trade secret content, proprietary content, engineering content, drug-related content, 
health-related content, a medical record, a patient record, a financial record, account information, 
educational information, indication of harassment, indication of a crime, indication of policy or 
regulatory non-compliance, identification of a competitive entity, identification of an adverse 
entity, identification of a specific individual, transcript information, access to an employment- 
oriented website, content designated prohibited by pohcy, and trading information. 

10. (Original) A method of managing compliance with policies of an enterprise, comprising: 
detecting at periodic intervals events that correspond to user interactions with computers 

connected to a network of the enterprise; 
storing such events in a data facility; 

organizing the events by user, by computer and by event type; and 
presenting a summary of the events in a graphical-format report, wherein a viewer of the 
report may select the organization of the report. 

1 1 . (Original) A method of claim 1 0, fiirther comprising limiting access to the report based 
on a predetermined level of authority of the party seeking access. 
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12. (Original) A method of claim 10, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a trackball event, a cursor 

event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

1 3 . (Original) A method of claim 1 0, wherein the user is selected from the group consisting 
of an employee, a consultant, a teacher, a student, a government official, a patient, a volunteer, 
an attendant, a team member, a system adminisfrator, a confractor, a vendor, a clerk, a cashier, a 
teller, a compfroUer, an accountant, an attorney, a financial officer, a principal, an adminisfrator, 

a human resources employee, a broker, a gaming employee, a guard, a banker, a government 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 

14. (Original) A method of claim 10, wherein the report relates to compliance with a policy 
of the enterprise. 

1 5 . (Original) A method of claim 1 0, fiirther comprising sending an alert if a user is 
suspected of committing a security violation based on the user interactions with the computer. 

1 6. (Original) A method of claim 1 0, fiirther comprising increasing the rate of capture of user 
interactions if a user is suspected of committing a security violation. 

17. (Original) A method of claim 10, wherein the report relates to content viewed by the user, 
the content selected from the group consisting of chat room content, content relating to 
securities, insider trading information, content relating to gaming, pornographic content, illegal 
content, vulgar content, prurient content, gambling content, entertainment content, video game 
content, frade secret content, proprietary content, engineering content, drug-related content, 
health-related content, a medical record, a patient record, a financial record, account information, 
educational information, indication of harassment, indication of a crime, indication of policy or 
regulatory non-compliance, identification of a competitive entity, identification of an adverse 
entity, identification of a specific individual, transcript information, access to an employment- 
oriented website, content designated prohibited by policy, and frading information. 
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1 8 . (Original) A method of managing productivity of individuals operating within a business 
enterprise, comprising: 

detecting at periodic intervals events that correspond to user interactions with computers 

connected to a network of the enterprise; 
storing such events in a data facility; organizing the events by user, by computer and by 

event type; and 

presenting a summary of the events in a graphical-format report, wherein a viewer of the 
report may select the organization of the report. 

19. (Original) A method of claim 18, further comprising limiting access to the report based 
on a predetermined level of authority of the party seeking access. 

20. (Original) A method of claim 18, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a frackball event, a cursor 
event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

2 1 . (Original) A method of claim 1 8, wherein the user is selected from the group consisting 
of an employee, a consultant, a teacher, a student, a govemment official, a patient, a volunteer, 
an attendant, a team member, a system adminisfrator, a confractor, a vendor, a clerk, a cashier, a 
teller, a comptroller, an accountant, an attorney, a financial officer, a principal, an administrator, 
a human resources employee, a broker, a gaming employee, a guard, a banker, a govemment 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 

22. (Original) A method of claim 1 8, wherein the event relates to an employee's usage of the 
Internet. 

23. (Original) A method of claim 22, further comprising providing an alert if an employee's 
usage of the Internet exceeds a predetermined amount during a predetermined period of time. 
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24. (Original) A method of claim 1 8, wherein the report relates to content viewed by the user, 
the content selected from the group consisting of chat room content, content relating to 
securities, insider trading information, content relating to gaming, pornographic content, illegal 
content, vulgar content, prurient content, gambling content, entertainment content, video game 
content, trade secret content, proprietary content, engineering content, drug-related content, 
health-related content, a medical record, a patient record, a financial record, account information, 
educational information, indication of harassment, indication of a crime, indication of policy or 
regulatory non-compliance, identification of a competitive entity, identification of an adverse 
entity, identification of a specific individual, transcript information, access to an employment- 
oriented website, content designated prohibited by pohcy, and trading information. 

25 . (Currently amended) A system for managing security in an enterprise, comprising; 
an eemftft agent for detecting at periodic intervals events that correspond to user 

interactions with computers connected to a network of the enterprise; 
a data facility for storing the events detected by the agent; and 

a reporting facility for organizing and reporting the events by user, by computer and by 
event type. 

26. (Original) A system of claim 25, wherein the reporting facility generates a report in a 
graphical format. 

27. (Original) A system of claim 25, fiirther comprising a security facility for limiting access 
to the report based on a predetermined level of authority of the party seeking access. 

28. (Original) A system of claim 27, wherein the security facility comprises an encrj^tion 
facility. 

29. (Original) A system of claim 27, wherein the security facility comprises a password. 
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30. (Original) A system of claim 25, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a trackball event, a cursor 

event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

3 1 . (Original) A system of claim 25, wherein the user is selected from the group consisting of 
an employee, a consultant, a teacher, a student, a government official, a patient, a volunteer, an 
attendant, a team member, a system adminisfrator, a confractor, a vendor, a clerk, a cashier, a 
teller, a compfroUer, an accountant, an attorney, a financial officer, a principal, an adminisfrator, 

a human resources employee, a broker, a gaming employee, a guard, a banker, a government 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 

32. (Original) A system of claim 25, wherein the reporting facility reports compliance with a 
policy of the enterprise. 

33. (Original) A system of claim 25, wherein the reporting facility reports security events. 

34. (Original) A system of claim 25, wherein the reporting facility reports on performance of 
an objective of the enterprise. 

35. (Original) A system of claim 25, wherein the report facility reports on interaction by the 
user with content selected from the group consisting of chat room content, content relating to 
securities, insider frading information, content relating to gaming, pornographic content, illegal 
content, vulgar content, prurient content, gambling content, entertainment content, video game 
content, trade secret content, proprietary content, engineering content, drug-related content, 
health-related content, a medical record, a patient record, a financial record, account information, 
educational information, indication of harassment, indication of a crime, indication of policy or 
regulatory non-compliance, identification of a competitive entity, identification of an adverse 
entity, identification of a specific individual, transcript information, access to an employment- 
oriented website, content designated prohibited by policy, and frading information. 
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36. (Original) A system for managing compliance with policies of an enterprise, comprising: 
an agent for detecting at periodic intervals events that correspond to user interactions 

with computers connected to a network of the enterprise; 
a data facility for storing such events by user, by computer and by event type; and 
a reporting facility for presenting a summary of the events in a graphical-format report, 

wherein a viewer of the report may select the organization of the report. 

37. (Original) A system of claim 36, further comprising a security facility for limiting access 
to the report based on a predetermined level of authority of the party seeking access. 

38. (Original) A system of claim 37, wherein the security facility comprises an encryption 
facility. 

39. (Original) A system of claim 37, wherein the security facility comprises a password. 

40. (Original) A system of claim 36, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a trackball event, a cursor 
event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

41 . (Original) A system of claim 36, wherein the user is selected from the group consisting of 
an employee, a consultant, a teacher, a student, a govemment official, a patient, a volunteer, an 
attendant, a team member, a system administrator, a contractor, a vendor, a clerk, a cashier, a 
teller, a comptroller, an accountant, an attorney, a financial officer, a principal, an administrator, 
a human resources employee, a broker, a gaming employee, a guard, a banker, a govemment 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 

42. (Original) A system of claim 36, wherein the reporting facility reports events relating to 
compliance with a policy of the enterprise. 
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43. (Original) A system of claim 36, further comprising a communication facility for sending 
an alert if a user is suspected of committing a security violation based on the user interactions 
with the computer. 

44. (Original) A system of claim 36, further comprising a dynamic facility of the agent for 
increasing the rate of capture of user interactions if a user is suspected of committing a security 
violation. 

45. (Original) A system of claim 36, wherein the report reporting facility reports content 
viewed by the user, the content selected from the group consisting of chat room content, content 
relating to securities, insider trading information, content relating to gaming, pornographic 
content, illegal content, vulgar content, prurient content, gambling content, entertainment 
content, video game content, trade secret content, proprietary content, engineering content, drug- 
related content, health-related content, a medical record, a patient record, a financial record, 
account information, educational information, indication of harassment, indication of a crime, 
indication of policy or regulatory non-compliance, identification of a competitive entity, 
identification of an adverse entity, identification of a specific individual, transcript information, 
access to an employment-oriented website, content designated prohibited by policy, and trading 
information. 

46. (Original) A system for managing productivity of individuals operating within a business 
enterprise, comprising: an agent for detecting at periodic intervals events that correspond to user 
interactions with computers connected to a network of the enterprise; a data facility for storing 
such events by user, by computer and by event type; and a reporting facility for presenting a 
summary of the events in a graphical-format report, wherein a viewer of the report may select the 
organization of a report generated by the reporting facility. 

47. (Original) A system of claim 46, fiirther comprising limiting access to the report based on 
a predetermined level of authority of the party seeking access. 
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48. (Original) A system of claim 46, wherein the events are selected from the group 
consisting of keyboard event, a mouse event, an intellipoint event, a trackball event, a cursor 

event, a screen event, sensor event, a touchpad event, a tablet event, a touchscreen event, a 
joystick event, a pen event, a voice recognition event, and biometric event. 

49. (Original) A system of claim 46, wherein the user is selected from the group consisting of 
an employee, a consultant, a teacher, a student, a government official, a patient, a volunteer, an 
attendant, a team member, a system adminisfrator, a confractor, a vendor, a clerk, a cashier, a 
teller, a compfroUer, an accountant, an attorney, a financial officer, a principal, an adminisfrator, 

a human resources employee, a broker, a gaming employee, a guard, a banker, a government 
official, a trustee, a guardian, a steward, an authorized user and a non-authorized user. 

50. (Original) A system of claim 46, wherein the event relates to an employee's usage of the 
Internet. 

5 1 . (Original) A system of claim 50, fiirther comprising an alarm facility for providing an 
alert if an employee's usage of the Internet exceeds a predetermined amount during a 
predetermined period of time. 

52. (Original) A system of claim 46, wherein the report relates to content viewed by the user, 
the content selected from the group consisting of chat room content, content relating to 
securities, insider trading information, content relating to gaming, pornographic content, illegal 
content, vulgar content, prurient content, gambling content, entertainment content, video game 
content, trade secret content, proprietary content, engineering content, drug-related content, 
health-related content, a medical record, a patient record, a financial record, account information, 
educational information, indication of harassment, indication of a crime, indication of policy or 
regulatory non-compliance, identification of a competitive entity, identification of an adverse 
entity, identification of a specific individual, franscript information, access to an employment- 
oriented website, content designated prohibited by policy, and frading information. 

53. (Original) A method of managing security in an enterprise, comprising: 
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detecting at periodic intervals events that correspond to user interactions with computers 
connected to a network of the enterprise; storing such events in a data facility; 

organizing the events by user, by computer and by event type; permitting access by an 
individual to the stored events; and 

logging events that indicate the nature of the access by the individual to the stored events. 
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